Privacy & Data

Last updated: May 23, 2026

The privacy of your data — and it is your data, not ours — matters to us. This policy explains what we collect and why, how your data is handled, and your rights with respect to it. We never sell your personal data.

This policy applies to the SkinSeoul Creator Hub operated by SkinSeoul Pte. Ltd. (Singapore), which is the data controller for the Creator Hub ("SkinSeoul", "we", "us"). It covers information about creators and visitors who use the Creator Hub.

If you are a California resident or located in the EU/EEA or UK, additional disclosures and rights apply to you — see the California Residents and EU/EEA and UK Residents sections below.

What we collect and why

Our guiding principle is to collect only what we need.

Identity & account information

When you sign up, we collect identifying information such as your name, email address, and a profile. This lets us create and personalize your account and send essential account and campaign communications. With your consent, we may also send you newsletters or optional surveys.

Social media profiles & metrics

To match you with campaigns and measure campaign performance, we collect the social media accounts you connect or provide (e.g. Instagram, TikTok, YouTube handles), along with related public metrics such as follower counts, engagement rates, and the URLs and performance of content you publish for campaigns. Where you connect an account via a social platform's authorization flow, we receive only the data permitted by that platform and your consent.

Campaign content & submissions

We store the content and submissions you provide for campaigns so the Services can function as intended and so brands can review and use your Creator Content under the Terms & Conditions.

Payout & tax information

If you are eligible for monetary Rewards, we collect the payout and tax details needed to pay you and meet our legal obligations. Payment-card or bank details are handled by our payment processor; we retain only the records needed for accounting, payouts, and fraud prevention.

Device, log & usage data

We log information such as your IP address, browser and operating-system version, and how you interact with the Services, for security, fraud prevention, analytics, and improving the product. If you are signed in, some of this data is associated with your account while it is active.

Cookies & similar technologies

We use first-party and limited third-party cookies to keep you signed in, remember preferences, support analytics, and run experiments. You can control cookies in your browser settings, though some features may not work if you disable them.

Voluntary correspondence

When you contact support, we keep that correspondence and your email address so we have a history to reference if you reach out again.

Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we process your personal data on these legal bases (Article 6):

  • Performance of a contract (Art. 6(1)(b)) — to create and manage your account, provide the Creator Hub, process payouts, and provide support.
  • Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve the platform; prevent fraud and abuse; produce aggregated analytics and campaign metrics; and enforce our Terms. We balance these interests against your rights.
  • Consent (Art. 6(1)(a)) — for marketing communications, optional cookies/trackers, and connecting your social accounts. You may withdraw consent at any time (see Right to withdraw consent).
  • Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, anti–money-laundering (AML), and know-your-customer (KYC) obligations tied to creator payouts.

In short: we rely on contract and legitimate interests for account info and social metrics; contract and legal obligation for payouts; and consent and legitimate interests for marketing.

When we access or disclose your information

  • To provide the Services. We use third-party subprocessors to operate the Creator Hub. Current subprocessors include Amazon Web Services (hosting, us-west-2), Google Cloud Platform (hosting, us-west2), Stripe (payment processing), and Trolley (creator payouts and tax compliance). This list is current as of the last-updated date above; we update it when our vendors change. We do not currently use third-party advertising or analytics SDKs.
  • With brands, for campaigns you join. When you participate in a campaign, we share the information necessary for that campaign (e.g. your handle, submissions, and agreed metrics) with the relevant brand partner.
  • At your direction. When you connect a third-party service (such as a social platform), we exchange data with it as needed and as you authorize.
  • For legal and safety reasons. We may disclose information to comply with applicable law, respond to valid legal process, prevent fraud or abuse, or protect the rights, property, and safety of our users, the public, or the Company.
  • Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. Where required by law, we will notify you and ensure the recipient protects your data consistently with this policy.
  • Aggregated or de-identified data. We may use aggregated or de-identified data for any purpose, including analytics and marketing.

No SkinSeoul staff looks at your private content except for limited purposes with your permission (for example, to resolve a support request or fix an error), or where required by law.

Your rights with respect to your information

We strive to apply the same data rights to all creators, regardless of location. Subject to applicable law, these include the rights to:

  • Know and access the personal information we hold about you.
  • Correct inaccurate personal information.
  • Erase your personal information ("right to be forgotten"). Some deletion requests may require closing your account because the Services can no longer function without that data.
  • Restrict or object to certain processing, including direct marketing.
  • Portability — receive a copy of your data and transmit it elsewhere.
  • Withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. You can do this via your account and communication settings, your cookie preferences, or by contacting us. If you withdraw consent, some features that rely on it may become unavailable.
  • Not be subject to solely automated decisions that produce legal or similarly significant effects, except as permitted by law.
  • Complain to a supervisory authority.
  • Non-discrimination for exercising your privacy rights.

Many of these can be exercised by updating your account settings. For anything else, contact us at privacy@skin-seoul.com. We may need to verify your identity before responding.

Responding to your requests

  • Where the GDPR / UK GDPR applies, we generally respond within one month, extendable by up to two further months for complex or numerous requests (we will tell you if we extend).
  • Where the CCPA / CPRA applies, we respond to verifiable requests within 45 days, extendable once by another 45 days (up to 90 total) with notice.

California Residents (CCPA / CPRA)

If you are a California resident, the CCPA (as amended by the CPRA) gives you specific rights and requires specific disclosures.

Categories of personal information we collect (in the past 12 months):

  • Identifiers (name, username, email address, and government/tax ID where required for KYC)
  • Customer records (billing/payout details — processed via our payment providers)
  • Commercial information (campaigns joined, earnings, transaction history)
  • Internet/network activity (device identifiers, IP address, log and usage data, cookies)
  • Approximate geolocation (inferred from IP address)
  • Professional information (creator profile, brand partnerships)
  • Inferences (preferences/interests for service improvement)
  • Sensitive personal information only where necessary (e.g. government/tax ID for KYC/AML and payouts)

Purposes: providing and securing the platform, account management, creator payouts, campaign measurement, fraud prevention, legal/AML/KYC compliance, support, product improvement, and — where permitted — marketing.

Sale or sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If we introduce such SDKs in the future, we will provide a "Do Not Sell or Share My Personal Information" control and honor Global Privacy Control signals. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information: used only for the limited purposes permitted by the CPRA (identity verification, KYC/AML, tax, and account security); not used for inferring characteristics.

Retention: see Data retention & deletion below.

EU/EEA and UK Residents (GDPR / UK GDPR)

If you are located in the EEA or UK, the GDPR / UK GDPR applies to your personal data.

Legal bases: see Legal bases for processing above.

Your rights: access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right not to be subject to solely automated decision-making — as listed under Your rights above.

Data controller: SkinSeoul Pte. Ltd., 23 Keppel Bay View, #24-73, Reflections at Keppel Bay, Singapore 098414 — privacy@skin-seoul.com.

As an early-stage company whose processing does not currently trigger a mandatory Data Protection Officer requirement, we have not appointed a DPO, an EU representative, or a UK representative. If our processing later requires any of these, we will designate them and list their contact details here. In the meantime, please direct all privacy matters to privacy@skin-seoul.com.

Right to complain: you may lodge a complaint with your local supervisory authority (EU authorities: edpb.europa.eu; UK: ico.org.uk).

How we secure your data

All data is encrypted via SSL/TLS when transmitted between our servers and your device, and backups are encrypted. We take additional measures to protect data at rest, including restricting access to personal information to authorized personnel who need it to perform their duties. No method of transmission or storage is 100% secure, but we work hard to protect your information and continually improve our safeguards.

Data retention & deletion

We keep your information only as long as necessary for the purposes described in this policy or as required to meet legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will delete or de-identify your personal data within 60 days, except where we must retain certain records (for example, for tax or accounting purposes).

Location of data & international transfers

The Creator Hub is operated using infrastructure located in the United States (Amazon Web Services, region us-west-2; Google Cloud Platform, region us-west2). If you are located in the EU/EEA, UK, or elsewhere outside the United States, your information will be transferred to and stored in the United States.

Where the GDPR / UK GDPR applies and we transfer personal data to countries without an adequacy decision, we implement appropriate safeguards, such as:

  • the EU Standard Contractual Clauses (SCCs) adopted by the European Commission, with any required supplementary measures;
  • the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs; and/or
  • where applicable, reliance on the EU-US Data Privacy Framework for certified recipients.

In practice, we rely on the data processing agreements offered by our major subprocessors (such as Amazon Web Services, Google Cloud, Stripe, and Trolley), which incorporate the EU SCCs and the UK Addendum and, where applicable, EU-US Data Privacy Framework certification.

Children's Privacy

The Creator Hub is intended only for individuals who are at least 18 years old (or the age of majority in their jurisdiction, if higher). We do not knowingly collect personal data from anyone under 18 or allow them to register. If we learn we have collected data from someone under 18, we will take reasonable steps to delete it and close the account. Contact us at privacy@skin-seoul.com if you believe a minor has provided us personal data.

Changes & questions

We may update this policy as needed to comply with regulations and reflect new practices. Whenever we make a significant change, we will refresh the date at the top of this page and notify you (for example, by email or a prominent notice in the Creator Hub). Questions about this policy or your data? Contact us at privacy@skin-seoul.com.